Skip to content

Commit d7f896b

Browse files
jan-cernyjan-cerny
authored
Merge pull request #13862 from teacup-on-rockingchair/sle15_directory_permissions_var_log_audit
SLE15 directory permissions and file ownership rules for var log audit
2 parents 3d98882 + 357209c commit d7f896b

6 files changed

Lines changed: 438 additions & 5 deletions

File tree

  • linux_os/guide
    • auditing/auditd_configure_rules
    • system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/oval

‎linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/ansible/shared.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# platform = multi_platform_sle
2+
# reboot = false
3+
# strategy = restrict
4+
# complexity = low
5+
# disruption = low
6+
7+
- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
8+
ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
9+
check_mode: False
10+
failed_when: false
11+
register: log_file_exists
12+
13+
- name: "{{{ rule_title }}} - Set audit log file fact"
14+
ansible.builtin.set_fact:
15+
log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
16+
17+
- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
18+
ansible.builtin.set_fact:
19+
log_file_dir: "/var/log/audit"
20+
when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
21+
22+
- name: "{{{ rule_title }}} - Set log_file_dir from log_file_line if configured"
23+
ansible.builtin.set_fact:
24+
log_file_dir: "{{ log_file_line | dirname}}"
25+
when: (log_file_line is defined) and (log_file_line | length > 0)
26+
27+
- name: "{{{ rule_title }}} - Get audit log group"
28+
ansible.builtin.command: grep -iw ^log_group /etc/audit/auditd.conf
29+
check_mode: False
30+
failed_when: false
31+
register: log_group_exists
32+
33+
- name: "{{{ rule_title }}} - Set audit log directory mode to 0700"
34+
ansible.builtin.file:
35+
path: "{{ log_file_dir }}"
36+
mode: 0700
37+
when: log_group_exists.stdout | length == 0
38+
39+
- name: "{{{ rule_title }}} - Set audit log directory mode to 0750"
40+
ansible.builtin.file:
41+
path: "{{ log_file_dir }}"
42+
mode: 0750
43+
when: log_group_exists.stdout | length > 0

‎linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_ubuntu,multi_platform_almalinux,multi_platform_fedora
1+
# platform = Red Hat Virtualization 4,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_ubuntu
22

33
if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
44
DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)

‎linux_os/guide/auditing/auditd_configure_rules/directory_permissions_var_log_audit/oval/sle15.xml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
<def-group>
2+
<definition class="compliance" id="directory_permissions_var_log_audit" version="1">
3+
{{{ oval_metadata("Checks for correct permissions for audit logs.", rule_title=rule_title) }}}
4+
<criteria operator="OR">
5+
<criteria operator="AND" comment="log_file set">
6+
<extend_definition comment="log file set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" negate="true" />
7+
8+
<criteria operator="OR">
9+
<criteria operator="AND" comment="log_file set and log_group set to not root">
10+
<criterion comment="log_group in auditd.conf is set" test_ref="test_auditd_conf_log_group_not_set" negate="true"/>
11+
<criterion comment="default log_file and log_group set" test_ref="test_permissions_audit_log_directory_not_root"/>
12+
</criteria>
13+
<criteria operator="AND" comment="log_file set and log_group root">
14+
<criterion comment="log_group in auditd.conf is not set" test_ref="test_auditd_conf_log_group_not_set"/>
15+
<criterion comment="default log_file and log_group root" test_ref="test_permissions_audit_log_directory_root"/>
16+
</criteria>
17+
</criteria>
18+
19+
</criteria>
20+
<criteria operator="AND" comment="log_file not set">
21+
<extend_definition comment="log file not set in auditd.conf" definition_ref="auditd_conf_log_file_not_set" />
22+
23+
<criteria operator="OR">
24+
<criteria operator="AND" comment="default log_file and log_group set to not root">
25+
<criterion comment="log_group in auditd.conf is set" test_ref="test_auditd_conf_log_group_not_set" negate="true"/>
26+
<criterion comment="default log_file and log_group set" test_ref="test_permissions_default_audit_log_directory_not_root"/>
27+
</criteria>
28+
<criteria operator="AND" comment="default log_file and log_group root">
29+
<criterion comment="log_group in auditd.conf is not set" test_ref="test_auditd_conf_log_group_not_set"/>
30+
<criterion comment="default log_file and log_group root" test_ref="test_permissions_default_audit_log_directory_root"/>
31+
</criteria>
32+
</criteria>
33+
34+
</criteria>
35+
</criteria>
36+
</definition>
37+
38+
39+
<ind:textfilecontent54_object id="object_auditd_conf_log_group_configured" comment="log_group is set" version="1">
40+
<ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
41+
<ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ](\w+)$</ind:pattern>
42+
<ind:instance datatype="int">1</ind:instance>
43+
</ind:textfilecontent54_object>
44+
45+
<ind:textfilecontent54_test id="test_auditd_conf_log_group_not_set" check="all" check_existence="none_exist" comment="log_group not set" version="1">
46+
<ind:object object_ref="object_auditd_conf_log_group_configured" />
47+
</ind:textfilecontent54_test>
48+
49+
<local_variable id="audit_log_dir" datatype="string" version="1" comment="path to audit log directory">
50+
<regex_capture pattern="^(.*)\/([^\/]+$)">
51+
<variable_component var_ref="audit_log_file_path" />
52+
</regex_capture>
53+
</local_variable>
54+
55+
<!-- non default file and state 0700 -->
56+
<unix:file_test check="all" check_existence="all_exist" comment="non default audit log dir mode 0700" id="test_permissions_audit_log_directory_root" version="1">
57+
<unix:object object_ref="object_var_log_audit_directory_non_default_root" />
58+
<unix:state state_ref="state_mode_0700" />
59+
</unix:file_test>
60+
<unix:file_object comment="non default audit log dir" id="object_var_log_audit_directory_non_default_root" version="1">
61+
<unix:path operation="equals" var_ref="audit_log_dir" />
62+
<unix:filename xsi:nil="true" />
63+
</unix:file_object>
64+
65+
<!-- non default file and state 0750 -->
66+
<unix:file_test check="all" check_existence="all_exist" comment="non default audit log dir mode 0700" id="test_permissions_audit_log_directory_not_root" version="1">
67+
<unix:object object_ref="object_var_log_audit_directory_non_default_not_root" />
68+
<unix:state state_ref="state_mode_0750" />
69+
</unix:file_test>
70+
<unix:file_object comment="non default audit log dir" id="object_var_log_audit_directory_non_default_not_root" version="1">
71+
<unix:path operation="equals" var_ref="audit_log_dir" />
72+
<unix:filename xsi:nil="true" />
73+
</unix:file_object>
74+
75+
<!-- default file and state 0700 -->
76+
<unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit mode 0700" id="test_permissions_default_audit_log_directory_root" version="1">
77+
<unix:object object_ref="object_var_log_audit_directory_root" />
78+
<unix:state state_ref="state_mode_0700" />
79+
</unix:file_test>
80+
<unix:file_object comment="/var/log/audit dir" id="object_var_log_audit_directory_root" version="1">
81+
<unix:path>/var/log/audit</unix:path>
82+
<unix:filename xsi:nil="true" />
83+
</unix:file_object>
84+
85+
<!-- default file and state 0750 -->
86+
<unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit mode 0750" id="test_permissions_default_audit_log_directory_not_root" version="1">
87+
<unix:object object_ref="object_var_log_audit_directory_non_root" />
88+
<unix:state state_ref="state_mode_0750" />
89+
</unix:file_test>
90+
<unix:file_object comment="/var/log/audit dir" id="object_var_log_audit_directory_non_root" version="1">
91+
<unix:path>/var/log/audit</unix:path>
92+
<unix:filename xsi:nil="true"/>
93+
</unix:file_object>
94+
95+
<unix:file_state id="state_mode_0700" operator="AND" version="3">
96+
<unix:suid datatype="boolean">false</unix:suid>
97+
<unix:sgid datatype="boolean">false</unix:sgid>
98+
<unix:sticky datatype="boolean">false</unix:sticky>
99+
<unix:uread datatype="boolean">true</unix:uread>
100+
<unix:uwrite datatype="boolean">true</unix:uwrite>
101+
<unix:uexec datatype="boolean">true</unix:uexec>
102+
<unix:gread datatype="boolean">false</unix:gread>
103+
<unix:gwrite datatype="boolean">false</unix:gwrite>
104+
<unix:gexec datatype="boolean">false</unix:gexec>
105+
<unix:oread datatype="boolean">false</unix:oread>
106+
<unix:owrite datatype="boolean">false</unix:owrite>
107+
<unix:oexec datatype="boolean">false</unix:oexec>
108+
</unix:file_state>
109+
110+
<unix:file_state id="state_mode_0750" operator="AND" version="3">
111+
<unix:suid datatype="boolean">false</unix:suid>
112+
<unix:sgid datatype="boolean">false</unix:sgid>
113+
<unix:sticky datatype="boolean">false</unix:sticky>
114+
<unix:uread datatype="boolean">true</unix:uread>
115+
<unix:uwrite datatype="boolean">true</unix:uwrite>
116+
<unix:uexec datatype="boolean">true</unix:uexec>
117+
<unix:gread datatype="boolean">true</unix:gread>
118+
<unix:gwrite datatype="boolean">false</unix:gwrite>
119+
<unix:gexec datatype="boolean">true</unix:gexec>
120+
<unix:oread datatype="boolean">false</unix:oread>
121+
<unix:owrite datatype="boolean">false</unix:owrite>
122+
<unix:oexec datatype="boolean">false</unix:oexec>
123+
</unix:file_state>
124+
</def-group>

‎linux_os/guide/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/ansible/shared.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# platform = multi_platform_sle
2+
# reboot = false
3+
# strategy = restrict
4+
# complexity = low
5+
# disruption = low
6+
7+
- name: "{{{ rule_title }}} - Get audit log file from /etc/audit/auditd.conf"
8+
ansible.builtin.command: grep -iw ^log_file /etc/audit/auditd.conf
9+
check_mode: False
10+
failed_when: false
11+
register: log_file_exists
12+
13+
- name: "{{{ rule_title }}} - Set audit log file fact"
14+
ansible.builtin.set_fact:
15+
log_file_line: "{{ log_file_exists.stdout | split(' ') | last }}"
16+
17+
- name: "{{{ rule_title }}} - Set default log_file if not configured in /etc/audit/auditd.conf"
18+
ansible.builtin.set_fact:
19+
log_file: "/var/log/audit/audit.log"
20+
when: (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
21+
22+
- name: "{{{ rule_title }}} - Set log_file from log_file_line if configured"
23+
ansible.builtin.set_fact:
24+
log_file: "{{ log_file_line }}"
25+
when: (log_file_line is defined) and (log_file_line | length > 0)
26+
27+
- name: "{{{ rule_title }}} - Get all audit backup log file(s)"
28+
ansible.builtin.find:
29+
path: "{{ log_file | dirname }}"
30+
patterns: "{{ log_file | basename }}.*"
31+
register: backup_files
32+
33+
- name: "{{{ rule_title }}} - Set root as owner to all audit backup log file(s)"
34+
ansible.builtin.file:
35+
path: "{{ item }}"
36+
owner: root
37+
loop: "{{ backup_files.files| map(attribute='path') | list }}"
38+
39+
- name: "{{{ rule_title }}} - Set root as owner to audit log file"
40+
ansible.builtin.file:
41+
path: "{{ log_file }}"
42+
owner: root

‎linux_os/guide/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,13 @@ fixtext: |-
7474
7575
If the log_group is not defined or it is set to root, configure the permissions the following way:
7676
77-
$ sudo chmod 0640 $log_file
78-
$ sudo chmod 0440 $log_file.*
77+
$ sudo chmod 0600 $log_file
78+
$ sudo chmod 0400 $log_file.*
7979
8080
Otherwise, configure the permisssions the following way:
8181
82-
$ sudo chmod 0600 $log_file
83-
$ sudo chmod 0400 $log_file.*
82+
$ sudo chmod 0640 $log_file
83+
$ sudo chmod 0440 $log_file.*
8484
8585
srg_requirement: |-
8686
{{{ full_name }}} audit log file must have mode 0640 or less permissive to prevent unauthorized access to the audit log.

0 commit comments

Comments
 (0)